00eb301b35855d4b90cfdd3a62820ca9b7468f65d1317ae60a7e0bb52b82368e

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-03-2024 11:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20ef3fb27b45fa819c577cd58a25f5f6_JaffaCakes118.exe
Size

160KB
MD5

20ef3fb27b45fa819c577cd58a25f5f6
SHA1

079d1ea0e7de1d20ed86c80b6f87f2b4fee65f3f
SHA256

00eb301b35855d4b90cfdd3a62820ca9b7468f65d1317ae60a7e0bb52b82368e
SHA512

6b960ccb925c1712458b50a05bc4553db1203f82c46dcb59ab76352c5a30e8fb6f9180dfd23ca6353d521db1e147bf849964c60b986990ad8c12430f6e6975fb
SSDEEP

3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/k8f:o68i3odBiTl2+TCU//

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft I Service = "C:\\Windows\\winhash_up.exe /REGstart"	20ef3fb27b45fa819c577cd58a25f5f6_JaffaCakes118.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\winhash_up.exez	20ef3fb27b45fa819c577cd58a25f5f6_JaffaCakes118.exe
File opened for modification	C:\Windows\winhash_up.exez	20ef3fb27b45fa819c577cd58a25f5f6_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon3.ico	20ef3fb27b45fa819c577cd58a25f5f6_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon12.ico	20ef3fb27b45fa819c577cd58a25f5f6_JaffaCakes118.exe
File created	C:\Windows\bugMAKER.bat	20ef3fb27b45fa819c577cd58a25f5f6_JaffaCakes118.exe
File created	C:\Windows\winhash_up.exe	20ef3fb27b45fa819c577cd58a25f5f6_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon2.ico	20ef3fb27b45fa819c577cd58a25f5f6_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon5.ico	20ef3fb27b45fa819c577cd58a25f5f6_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon6.ico	20ef3fb27b45fa819c577cd58a25f5f6_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon7.ico	20ef3fb27b45fa819c577cd58a25f5f6_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon10.ico	20ef3fb27b45fa819c577cd58a25f5f6_JaffaCakes118.exe
File created	C:\Windows\SHARE_TEMP\Icon14.ico	20ef3fb27b45fa819c577cd58a25f5f6_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2688	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3784 wrote to memory of 2688	3784	20ef3fb27b45fa819c577cd58a25f5f6_JaffaCakes118.exe	88
PID 3784 wrote to memory of 2688	3784	20ef3fb27b45fa819c577cd58a25f5f6_JaffaCakes118.exe	88
PID 3784 wrote to memory of 2688	3784	20ef3fb27b45fa819c577cd58a25f5f6_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\20ef3fb27b45fa819c577cd58a25f5f6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\20ef3fb27b45fa819c577cd58a25f5f6_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\bugMAKER.bat
  2⤵
  - Checks computer location settings
  - Suspicious use of SetWindowsHookEx
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\bugMAKER.bat

Filesize
90B

MD5
858ae98082e46bcd6aafcb7e4989f47e

SHA1
c8b349731b2e354357bce5e051a74279f9e64318

SHA256
33f14af496ef7ea4645e8053ad6bb2e5a66a3fd981f7d87a8e116eaeb1f1bace

SHA512
dc1ec1ffd9bca78953aa602ed882051abe29a916c204442f3e6be50b37932ae0a9f425d6a241450a33d6d411147248cadd59bb32d38d4be7f1f900a0f752eb9c

Download Submit
memory/3784-24-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads